The MIFARE® classic family, developed by NXP Semiconductors is the pioneer and front runner in contactless smart card ICs operating in the 13.56 MHz frequency range with read/write capability. MIFARE® is a trademark of NXP Semiconductors. MIFARE complies with IS014443 A, which is used in more than 80% of all contactless smart cards today. The technology is embodied in both cards and card reader devices. MIFARE cards are being used in an increasingly broad range of applications (including transport ticketing, access control, e-payment, road tolling, and loyalty applications). MIFARE Standard (or Classic) cards employ a proprietary high-level protocol with a proprietary security protocol for authentication and ciphering. MIFARE® technology has become a standard for memory devices with key-protected memory sectors. One example for a published product specification of MIFARE® technology is the data sheet “MIFARE®Standard Card IC MF1 IC S50-Functional Specification” (1998) which is herein incorporated by reference. MIFARE® technology is also discussed in: Klaus Finkenzeller, “RFID Handbuch”, HANSER, 3rd edition (2002).
The MIFARE Classic cards are fundamentally just memory storage devices, where the memory is divided into sectors and blocks with simple security mechanisms for access control. Each device has a unique serial number. Anticollision is provided so that several cards in the field may be selected and operated in sequence.
The MIFARE Standard 1 k offers about 768 bytes of data storage, split into 16 sectors with 4 blocks of 16 bytes each (one block consists of 16 byte); each sector is protected by two different keys, called A and B. They can be programmed for operations like reading, writing, increasing value blocks, etc. The last block of each sector is called “trailer”, which contains two secret keys (A and B) and programmable access conditions for each block in this sector. In order to support multi-application with key hierarchy an individual set of two keys (A and B) per sector (per application) is provided.
The memory organization of a MIFARE Standard 1 k card is shown in FIG. 1. The 1024×8 bit EEPROM memory is organized in 16 sectors with 4 blocks of 16 bytes each. The first data block (block 0) of the first sector (sector 0) is the manufacturer block which is shown in detail in FIG. 2. It contains the serial number of the MIFARE card that has a length of four bytes (bytes 0 to 3), a check byte (byte 4) and eleven bytes of IC manufacturer data (bytes 5 to 15). The serial number is sometimes called MIFARE User IDentification (MUID) and is a unique number. Due to security and system requirements the manufacturer block is write protected after having been programmed by the IC manufacturer at production. However, the MIFARE specification allows to change the serial number during operation of the MIFARE card, which is particularly useful for MIFARE emulation cards like SmartMX cards.
SmartMX (Memory eXtension) is a family of smart cards that have been designed by NXP Semiconductors for high-security smart card applications requiring highly reliable solutions, with or without multiple interface options. Key applications are e-government, banking/finance, mobile communications and advanced public transportation.
The ability to run the MIFARE protocol concurrently with other contactless transmission protocols implemented by the User Operating System enables the combination of new services and existing applications based on MIFARE (e.g. ticketing) on a single Dual Interface controller based smart card. SmartMX cards are able to emulate MIFARE Classic devices and thereby makes this interface compatible with any installed MIFARE Classic infrastructure. The contactless interface can be used to communicate via any protocol, particularly the MIFARE protocol and self defined contactless transmission protocols. SmartMX enables the easy implementation of state-of-the-art operating systems and open platform solutions including JCOP (the Java Card Operating System) and offers an optimized feature set together with the highest levels of security. SmartMX incorporates a range of security features to counter measure side channel attacks like DPA, SPA etc. A true anticollision method (acc. ISO/IEC 14443-3), enables multiple cards to be handled simultaneously.
Building on the huge installed base of the MIFARE® interface platform, SmartMX enables e.g. Service Providers to introduce even more convenient ticketing systems and payment concepts. The high security (PKI and 3-DES) and the extended functionality of SmartMX allows for the integration of loyalty concepts, access to vending machines, or using an e-purse to pay fares instead of pre-paid electronic ticketing. The essential features of SmartMX cards are the following:                Contact interface UART according to ISO 7816.        Contactless interface UART according to ISO 14443.        Exception sensors for voltage, frequency and temperature.        Memory management unit.        MIFARE® classic emulation.        JavaCard Operating System.        DES and/or RSA engine.        Up to 72 kilobyte EEPROM memory space.        
It should be noted that the emulation of MIFARE Classic cards is not only restricted to SmartMX cards, but there may also exist other present or future smartcards being able to emulate MIFARE Classic cards.
Recently, mobile communication devices have been developed which contain or are connectable to memory devices comprising a plurality of memory sectors, wherein the memory sectors are protected against unauthorized access by sector keys. Examples of such memory devices comprise MIFARE Classic cards or emulated MIFARE Classic devices like SmartMX cards. These mobile communication devices are e.g. configured as mobile phones with Near Field Communication (NFC) capabilities. Mobile communication devices that are equipped with the above explained memory devices can be used for multi-application purposes. I.e. it is possible to install a plurality of applications, like tickets, coupons, access controls and so on in one memory device. Each application is stored in one or more separate sector(s) of the memory device such that terminal readers are only able to read those applications that are stored in sectors with the sector keys being known by the terminal readers.
While this protection concept works well as long as the owner of the mobile communication device is in possession of the same there is a potential security risk if the mobile communication device is stolen. Let us assume that the mobile communication device that has been stolen is a mobile phone. In this case the user when becoming aware of the theft will immediately inform the Mobile Network Operator that his mobile phone has been lost or stolen, whereupon the Mobile Network Operator can remotely block its basic network services for this mobile phone. However, the applications stored in the memory device are still available for use at the terminal readers since these terminal readers do not identify the actual user of the mobile phone. This represents an important security issue that needs to be addressed before NFC value-added services are deployed by Mobile Network Operators.